eclipse-vertx/vert.x · error · VertxException

Cannot determine EC parameter spec for curve name/OID

Error message

Cannot determine EC parameter spec for curve name/OID

What it means

PrivateKeyParser.getECParameterSpec maps an EC curve name/OID to java.security.spec ECParameterSpec by generating a throwaway keypair with KeyPairGenerator('EC') and ECGenParameterSpec. If the JCA provider cannot handle the curve (unknown name/OID, unsupported curve), the GeneralSecurityException is wrapped into VertxException('Cannot determine EC parameter spec for curve name/OID').

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/pkcs1/PrivateKeyParser.java:77

        }
        value <<= 7;
        value |= (oid[index] & 0b01111111);
        result.append(".").append(value);
      } else {
        result.append(".").append(bValue);
      }
    }
    return result.toString();
  }

  private static ECParameterSpec getECParameterSpec(String curveName) throws VertxException {
    try {
      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
      keyPairGenerator.initialize(new ECGenParameterSpec(curveName));
      ECPublicKey publicKey = (ECPublicKey) keyPairGenerator.generateKeyPair().getPublic();
      return publicKey.getParams();
    } catch (GeneralSecurityException e) {
      throw new VertxException("Cannot determine EC parameter spec for curve name/OID", e);
    }
  }

  /**
   * Gets the algorithm used by a PKCS#8 encoded private key.
   *
   * @param encodedKey The encoded private key.
   * @return The algorithm name, either <em>RSA</em> or <em>EC</em>, depending on
   *         the algorithm identifier found in the encoded key.
   * @throws VertxException if the key is not PKCS#8 encoded or uses an unsupported
   *         algorithm.
   */
  public static String getPKCS8EncodedKeyAlgorithm(byte[] encodedKey) {

    DerParser parser = new DerParser(encodedKey);
    Asn1Object sequence = parser.read();
    if (sequence.getType() != DerParser.SEQUENCE) {
      throw new VertxException("Invalid PKCS8 encoding: not a sequence");

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Use a JDK/provider that supports the curve (or upgrade the JDK)
2. Re-export the key on a widely supported curve (e.g. prime256v1, secp384r1, secp521r1)
3. Register a provider supporting the curve (e.g. BouncyCastle) via Security.addProvider

Example fix

// before
openssl ecparam -genkey -name secp256k1 -out key.pem
// after
openssl ecparam -genkey -name prime256v1 -out key.pem  // or add BouncyCastle provider

try {
  new ECGenParameterSpec("prime256v1");
  KeyPairGenerator.getInstance("EC");
} catch (Exception e) {
  throw new IllegalStateException("EC provider/curve unavailable");
}

try {
  alg = PrivateKeyParser.getPKCS8EncodedKeyAlgorithm(der);
} catch (VertxException e) {
  // unsupported curve: re-export key on prime256v1/secp384r1 or add BouncyCastle
}

When it happens

Trigger: Parsing a private key with an EC curve not supported by the JVM's providers (e.g. exotic/secp curves, curve OIDs unknown to the provider), or on a JVM lacking the EC provider.

Common situations: Keys generated with OpenSSL on unusual curves (e.g. secp256k1 on older JDKs), older JDKs without full EC support, FIPS providers with restricted curve sets.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• ${certificate.getSigAlgName()}
• Invalid DER: not a sequence
• Invalid DER: 'version' field must be of type INTEGER (2) but
• Invalid DER: expected 'version' field to have value '1' but
• Invalid DER: expected to find an OBJECT_IDENTIFIER (6) in 'p

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/d07e9856f2a609c7. Report an issue: GitHub.